A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

A private endpoint for the storage account

A private endpoint creates a private IP in the VNet, which the question explicitly says they do not want to deploy.

A route table with a default route to the storage account

Route tables do not grant authorization to a service and cannot make a storage account accessible only from one subnet.

An application security group containing the subnet

Application security groups are used inside NSG rules for VM traffic, not for granting access to Azure Storage.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A service endpoint for Microsoft.Storage — A service endpoint is the right fit when the service should remain on its public endpoint but be restricted to a selected subnet. It extends the VNet identity to the Azure service without creating a private IP address in the VNet. This avoids private DNS management and still limits access to the approved subnet. It is not the same as a private endpoint, which would place a private IP in the VNet. Why others are wrong: A private endpoint creates exactly the private-IP design the team wants to avoid. Route tables do not control storage authorization. Application security groups are for grouping VM NICs in NSG rules and do not apply to storage account access control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.